AZ-305
Deep Dive
Backup design on the AZ-305: picking the right vault for each workload, configuring vault redundancy according to the DR requirement, and shielding backups against ransomware with immutability, soft delete and MUA.
Contents
Recovery Services Vault (classic)
Backup Vault (new)
Vault redundancy (chosen BEFORE protecting the first item)
LRS (cheap, intra-datacenter only) / ZRS (zones) / GRS (paired region). With GRS + Cross-Region Restore (CRR) you can restore in the secondary region WITHOUT waiting for Microsoft to declare a disaster. Requirement "restore VMs in another region if the primary goes down" → GRS + CRR.
| Workload | Mechanism | Design note |
|---|---|---|
| Azure VM | VM backup (snapshot + transfer to the vault) | App-consistent on Windows (VSS); enhanced policy for multiple backups/day and zones |
| SQL Server on VM | Workload extension inside the RSV | Fulls + differentials + logs every 15 min → 15-minute RPO |
| Azure SQL Database / MI | AUTOMATIC service backups (not the vault): PITR 1-35 days + LTR up to 10 years | Doesn't use Azure Backup — a common exam trap |
| Azure Files | Vault-orchestrated snapshots | Share soft delete as an extra layer |
| Blobs | Operational (continuous, in-account) or vaulted (copies to the vault) | Operational = fast local restore; vaulted = isolation from the source data |
| Disks | Scheduled incremental snapshots (Backup Vault) | Faster/cheaper than a full VM backup when only the disk matters |
| On-premises (files/system state) | MARS agent → RSV | Files/folders/system state only; for full Hyper-V/VMware → MABS/DPM |
| AKS | Backup extension → Backup Vault | Includes cluster resources and PVs |
Backup policy
Governance at scale
| Control | What it prevents |
|---|---|
| Soft delete (always-on available) | Deleted backups stay recoverable for 14+ days — an attacker can't destroy them immediately |
| Immutable vault (irreversible lock) | NO ONE can delete recovery points or reduce retention early — WORM for backups |
| Multi-User Authorization (MUA) | Critical operations (disabling soft delete, reducing retention) require approval from a second administrator via Resource Guard |
| CMK encryption | Backups encrypted with a customer key in Key Vault |
| Vault private endpoints | Backup traffic never leaves the private network |
| Security alerts | Notification on destructive operations (deletions, policy changes) |
Exam anti-ransomware combo
"An attacker with admin credentials must not be able to destroy the backups" → immutable vault (locked) + always-on soft delete + MUA with Resource Guard. All three layers together.
| Requirement | Design |
|---|---|
| VM backup restorable in another region | RSV with GRS + Cross-Region Restore |
| SQL Server on VM with a 15-minute RPO | SQL extension in the RSV (log backups every 15 min) |
| Retain SQL Database backups for 10 years | Service Long-Term Retention (not Azure Backup) |
| Auto-protect every new VM | Backup DINE Azure Policy |
| Backups immune to a compromised admin | Immutable vault + soft delete + MUA |
| Folders on an on-premises physical server | MARS agent → RSV |
| Reduce annual VM retention cost | Archive tier for older recovery points |
| Backup for flexible PostgreSQL / disks / blobs / AKS | Backup Vault |
Did you get this topic?
Test what you just learned
After a ransomware drill, the CISO requires that production VM backups: (1) cannot be deleted nor have their retention reduced by any administrator, (2) require approval from a second team for any critical vault operation, and (3) can be restored if the primary region becomes unavailable. What Recovery Services Vault configuration do you design?
Put what you learned to the test with original AZ-305 exam questions.
Start AZ-305 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.